// Copyright 2015 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// This is the version of the Android-specific Chromium linker that uses
// the Android M and later system linker to load libraries.

// This source code *cannot* depend on anything from base/ or the C++
// STL, to keep the final library small, and avoid ugly dependency issues.

#include "modern_linker_jni.h"

#include <dlfcn.h>
#include <errno.h>
#include <fcntl.h>
#include <jni.h>
#include <limits.h>
#include <link.h>
#include <stddef.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>

#include "android_dlext.h"
#include "linker_jni.h"

#define PAGE_START(x) ((x)&PAGE_MASK)
#define PAGE_END(x) PAGE_START((x) + (PAGE_SIZE - 1))

namespace chromium_android_linker {
namespace {

    // Record of the Java VM passed to JNI_OnLoad().
    static JavaVM* s_java_vm = nullptr;

    // Get the CPU ABI string for which the linker is running.
    //
    // The returned string is used to construct the path to libchrome.so when
    // loading directly from APK.
    //
    // |env| is the current JNI environment handle.
    // |clazz| is the static class handle for org.chromium.base.Linker,
    // and is ignored here.
    // Returns the CPU ABI string for which the linker is running.
    jstring GetCpuAbi(JNIEnv* env, jclass clazz)
    {
#if defined(__arm__) && defined(__ARM_ARCH_7A__)
        static const char* kCurrentAbi = "armeabi-v7a";
#elif defined(__arm__)
        static const char* kCurrentAbi = "armeabi";
#elif defined(__i386__)
        static const char* kCurrentAbi = "x86";
#elif defined(__mips__)
        static const char* kCurrentAbi = "mips";
#elif defined(__x86_64__)
        static const char* kCurrentAbi = "x86_64";
#elif defined(__aarch64__)
        static const char* kCurrentAbi = "arm64-v8a";
#else
#error "Unsupported target abi"
#endif
        return env->NewStringUTF(kCurrentAbi);
    }

    // Convenience wrapper around dlsym() on the main executable. Returns
    // the address of the requested symbol, or nullptr if not found. Status
    // is available from dlerror().
    void* Dlsym(const char* symbol_name)
    {
        static void* handle = nullptr;

        if (!handle)
            handle = dlopen(nullptr, RTLD_NOW);

        void* result = dlsym(handle, symbol_name);
        return result;
    }

    // dl_iterate_phdr() wrapper, accessed via dlsym lookup. Done this way.
    // so that this code compiles for Android versions that are too early to
    // offer it. Checks in LibraryLoader.java should ensure that we
    // never reach here at runtime on Android versions that are too old to
    // supply dl_iterate_phdr; that is, earlier than Android M. Returns
    // false if no dl_iterate_phdr() is available, otherwise true with the
    // return value from dl_iterate_phdr() in |status|.
    bool DlIteratePhdr(int (*callback)(dl_phdr_info*, size_t, void*),
        void* data,
        int* status)
    {
        using DlIteratePhdrCallback = int (*)(dl_phdr_info*, size_t, void*);
        using DlIteratePhdrFunctionPtr = int (*)(DlIteratePhdrCallback, void*);
        static DlIteratePhdrFunctionPtr function_ptr = nullptr;

        if (!function_ptr) {
            function_ptr = reinterpret_cast<DlIteratePhdrFunctionPtr>(Dlsym("dl_iterate_phdr"));
            if (!function_ptr) {
                LOG_ERROR("dlsym: dl_iterate_phdr: %s", dlerror());
                return false;
            }
        }

        *status = (*function_ptr)(callback, data);
        return true;
    }

    // Convenience struct wrapper round android_dlextinfo.
    struct AndroidDlextinfo {
        AndroidDlextinfo(int flags,
            void* reserved_addr, size_t reserved_size, int relro_fd)
        {
            memset(&extinfo, 0, sizeof(extinfo));
            extinfo.flags = flags;
            extinfo.reserved_addr = reserved_addr;
            extinfo.reserved_size = reserved_size;
            extinfo.relro_fd = relro_fd;
        }

        android_dlextinfo extinfo;
    };

    // android_dlopen_ext() wrapper, accessed via dlsym lookup. Returns false
    // if no android_dlopen_ext() is available, otherwise true with the return
    // value from android_dlopen_ext() in |status|.
    bool AndroidDlopenExt(const char* filename,
        int flag,
        const AndroidDlextinfo* dlextinfo,
        void** status)
    {
        using DlopenExtFunctionPtr = void* (*)(const char*,
            int, const android_dlextinfo*);
        static DlopenExtFunctionPtr function_ptr = nullptr;

        if (!function_ptr) {
            function_ptr = reinterpret_cast<DlopenExtFunctionPtr>(Dlsym("android_dlopen_ext"));
            if (!function_ptr) {
                LOG_ERROR("dlsym: android_dlopen_ext: %s", dlerror());
                return false;
            }
        }

        const android_dlextinfo* extinfo = &dlextinfo->extinfo;
        LOG_INFO("android_dlopen_ext:"
                 " flags=0x%llx, reserved_addr=%p, reserved_size=%d, relro_fd=%d",
            static_cast<long long>(extinfo->flags),
            extinfo->reserved_addr,
            static_cast<int>(extinfo->reserved_size),
            extinfo->relro_fd);

        *status = (*function_ptr)(filename, flag, extinfo);
        return true;
    }

    // Callback data for FindLoadedLibrarySize().
    struct CallbackData {
        explicit CallbackData(void* address)
            : load_address(address)
            , load_size(0)
            , min_vaddr(0)
        {
        }

        const void* load_address;
        size_t load_size;
        size_t min_vaddr;
    };

    // Callback for dl_iterate_phdr(). Read phdrs to identify whether or not
    // this library's load address matches the |load_address| passed in
    // |data|. If yes, pass back load size and min vaddr via |data|. A non-zero
    // return value terminates iteration.
    int FindLoadedLibrarySize(dl_phdr_info* info, size_t size UNUSED, void* data)
    {
        CallbackData* callback_data = reinterpret_cast<CallbackData*>(data);

        // Use max and min vaddr to compute the library's load size.
        ElfW(Addr) min_vaddr = ~0;
        ElfW(Addr) max_vaddr = 0;

        bool is_matching = false;
        for (size_t i = 0; i < info->dlpi_phnum; ++i) {
            const ElfW(Phdr)* phdr = &info->dlpi_phdr[i];
            if (phdr->p_type != PT_LOAD)
                continue;

            // See if this segment's load address matches what we passed to
            // android_dlopen_ext as extinfo.reserved_addr.
            void* load_addr = reinterpret_cast<void*>(info->dlpi_addr + phdr->p_vaddr);
            if (load_addr == callback_data->load_address)
                is_matching = true;

            if (phdr->p_vaddr < min_vaddr)
                min_vaddr = phdr->p_vaddr;
            if (phdr->p_vaddr + phdr->p_memsz > max_vaddr)
                max_vaddr = phdr->p_vaddr + phdr->p_memsz;
        }

        // If this library matches what we seek, return its load size.
        if (is_matching) {
            callback_data->load_size = PAGE_END(max_vaddr) - PAGE_START(min_vaddr);
            callback_data->min_vaddr = min_vaddr;
            return true;
        }

        return false;
    }

    // Helper class for anonymous memory mapping.
    class ScopedAnonymousMmap {
    public:
        ScopedAnonymousMmap(void* addr, size_t size);

        ~ScopedAnonymousMmap() { munmap(addr_, size_); }

        void* GetAddr() const { return effective_addr_; }
        void Release()
        {
            addr_ = nullptr;
            size_ = 0;
            effective_addr_ = nullptr;
        }

    private:
        void* addr_;
        size_t size_;

        // The effective_addr_ is the address seen by client code. It may or may
        // not be the same as addr_, the real start of the anonymous mapping.
        void* effective_addr_;
    };

    // ScopedAnonymousMmap constructor. |addr| is a requested mapping address, or
    // zero if any address will do, and |size| is the size of mapping required.
    ScopedAnonymousMmap::ScopedAnonymousMmap(void* addr, size_t size)
    {
#if RESERVE_BREAKPAD_GUARD_REGION
        // Increase size to extend the address reservation mapping so that it will
        // also include a guard region from load_bias_ to start_addr. If loading
        // at a fixed address, move our requested address back by the guard region
        // size.
        size += kBreakpadGuardRegionBytes;
        if (addr) {
            if (addr < reinterpret_cast<void*>(kBreakpadGuardRegionBytes)) {
                LOG_ERROR("Fixed address %p is too low to accommodate Breakpad guard",
                    addr);
                addr_ = MAP_FAILED;
                size_ = 0;
                return;
            }
            addr = reinterpret_cast<void*>(
                reinterpret_cast<uintptr_t>(addr) - kBreakpadGuardRegionBytes);
        }
        LOG_INFO("Added %d to size, for Breakpad guard",
            static_cast<int>(kBreakpadGuardRegionBytes));
#endif

        addr_ = mmap(addr, size, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
        if (addr_ != MAP_FAILED) {
            size_ = size;
        } else {
            LOG_INFO("mmap failed: %s", strerror(errno));
            size_ = 0;
        }
        effective_addr_ = addr_;

#if RESERVE_BREAKPAD_GUARD_REGION
        // If we increased size to accommodate a Breakpad guard region, move
        // the effective address, if valid, upwards by the size of the guard region.
        if (addr_ == MAP_FAILED)
            return;
        if (addr_ < reinterpret_cast<void*>(kBreakpadGuardRegionBytes)) {
            LOG_ERROR("Map address %p is too low to accommodate Breakpad guard",
                addr_);
            effective_addr_ = MAP_FAILED;
        } else {
            effective_addr_ = reinterpret_cast<void*>(
                reinterpret_cast<uintptr_t>(addr_) + kBreakpadGuardRegionBytes);
        }
#endif
    }

    // Helper for LoadLibrary(). Return the actual size of the library loaded
    // at |addr| in |load_size|, and the min vaddr in |min_vaddr|. Returns false
    // if the library appears not to be loaded.
    bool GetLibraryLoadSize(void* addr, size_t* load_size, size_t* min_vaddr)
    {
        LOG_INFO("Called for %p", addr);

        // Find the real load size and min vaddr for the library loaded at |addr|.
        CallbackData callback_data(addr);
        int status = 0;
        if (!DlIteratePhdr(&FindLoadedLibrarySize, &callback_data, &status)) {
            LOG_ERROR("No dl_iterate_phdr function found");
            return false;
        }
        if (!status) {
            LOG_ERROR("Failed to find library at address %p", addr);
            return false;
        }

        *load_size = callback_data.load_size;
        *min_vaddr = callback_data.min_vaddr;
        return true;
    }

    // Helper for LoadLibrary(). We reserve an address space larger than
    // needed. After library loading we want to trim that reservation to only
    // what is needed. Failure to trim should not occur, but if it does then
    // everything will still run, so we treat it as a warning rather than
    // an error.
    void ResizeReservedAddressSpace(void* addr,
        size_t reserved_size,
        size_t load_size,
        size_t min_vaddr)
    {
        LOG_INFO("Called for %p, reserved %d, loaded %d, min_vaddr %d",
            addr, static_cast<int>(reserved_size),
            static_cast<int>(load_size), static_cast<int>(min_vaddr));

        const uintptr_t uintptr_addr = reinterpret_cast<uintptr_t>(addr);

        if (reserved_size > load_size) {
            // Unmap the part of the reserved address space that is beyond the end of
            // the loaded library data.
            void* unmap = reinterpret_cast<void*>(uintptr_addr + load_size);
            const size_t length = reserved_size - load_size;
            if (munmap(unmap, length) == -1) {
                LOG_ERROR("WARNING: unmap of %d bytes at %p failed: %s",
                    static_cast<int>(length), unmap, strerror(errno));
            }
        } else {
            LOG_ERROR("WARNING: library reservation was too small");
        }

#if RESERVE_BREAKPAD_GUARD_REGION
        if (kBreakpadGuardRegionBytes > min_vaddr) {
            // Unmap the part of the reserved address space that is ahead of where we
            // actually need the guard region to start. Resizes the guard region to
            // min_vaddr bytes.
            void* unmap = reinterpret_cast<void*>(uintptr_addr - kBreakpadGuardRegionBytes);
            const size_t length = kBreakpadGuardRegionBytes - min_vaddr;
            if (munmap(unmap, length) == -1) {
                LOG_ERROR("WARNING: unmap of %d bytes at %p failed: %s",
                    static_cast<int>(length), unmap, strerror(errno));
            }
        } else {
            LOG_ERROR("WARNING: breakpad guard region reservation was too small");
        }
#endif
    }

    // Load a library with the chromium linker, using android_dlopen_ext().
    //
    // android_dlopen_ext() understands how to directly load from a zipfile,
    // based on the format of |dlopen_ext_path|. If it contains a "!/" separator
    // then the string indicates <zip_path>!/<file_path> and indicates the
    // file_path element within the zip file at zip_path. A library in a
    // zipfile must be uncompressed and page aligned. The library is expected
    // to be lib/<abi_tag>/crazy.<basename>. The <abi_tag> used will be the
    // same as the abi for this linker. The "crazy." prefix is included
    // so that the Android Package Manager doesn't extract the library into
    // /data/app-lib.
    //
    // If |dlopen_ext_path| contains no "!/" separator then android_dlopen_ext()
    // assumes that it is a normal path to a standalone library file.
    //
    // Loading the library will also call its JNI_OnLoad() method, which
    // shall register its methods. Note that lazy native method resolution
    // will _not_ work after this, because Dalvik uses the system's dlsym()
    // which won't see the new library, so explicit registration is mandatory.
    //
    // |env| is the current JNI environment handle.
    // |clazz| is the static class handle for org.chromium.base.Linker,
    // and is ignored here.
    // |dlopen_ext_path| is the library identifier (e.g. libfoo.so).
    // |load_address| is an explicit load address.
    // |relro_path| is the path to the file into which RELRO data is held.
    // |lib_info_obj| is a LibInfo handle used to communicate information
    // with the Java side.
    // Return true on success.
    jboolean LoadLibrary(JNIEnv* env,
        jclass clazz,
        jstring dlopen_ext_path,
        jlong load_address,
        jobject lib_info_obj)
    {
        String dlopen_library_path(env, dlopen_ext_path);
        LOG_INFO("Called for %s, at address 0x%llx",
            dlopen_library_path.c_str(), load_address);

        if (!IsValidAddress(load_address)) {
            LOG_ERROR("Invalid address 0x%llx", load_address);
            return false;
        }

        const size_t size = kAddressSpaceReservationSize;
        void* wanted_addr = reinterpret_cast<void*>(load_address);

        // Reserve the address space into which we load the library.
        ScopedAnonymousMmap mapping(wanted_addr, size);
        void* addr = mapping.GetAddr();
        if (addr == MAP_FAILED) {
            LOG_ERROR("Failed to reserve space for load");
            return false;
        }
        if (wanted_addr && addr != wanted_addr) {
            LOG_ERROR("Failed to obtain fixed address for load");
            return false;
        }

        // Build dlextinfo to load the library into the reserved space, using
        // the shared RELRO if supplied and if its start address matches addr.
        int relro_fd = -1;
        int flags = ANDROID_DLEXT_RESERVED_ADDRESS;
        if (wanted_addr && lib_info_obj) {
            void* relro_start;
            s_lib_info_fields.GetRelroInfo(env, lib_info_obj,
                reinterpret_cast<size_t*>(&relro_start),
                nullptr, &relro_fd);
            if (relro_fd != -1 && relro_start == addr) {
                flags |= ANDROID_DLEXT_USE_RELRO;
            }
        }
        AndroidDlextinfo dlextinfo(flags, addr, size, relro_fd);

        // Load the library into the reserved space.
        const char* path = dlopen_library_path.c_str();
        void* handle = nullptr;
        if (!AndroidDlopenExt(path, RTLD_NOW, &dlextinfo, &handle)) {
            LOG_ERROR("No android_dlopen_ext function found");
            return false;
        }
        if (handle == nullptr) {
            LOG_ERROR("android_dlopen_ext: %s", dlerror());
            return false;
        }

        // For https://crbug.com/568880.
        //
        // Release the scoped mapping. Now that the library has loaded we can no
        // longer assume we have control of all of this area. libdl knows addr and
        // has loaded the library into some portion of the reservation. It will
        // not expect that portion of memory to be arbitrarily unmapped.
        mapping.Release();

        // After loading we can find the actual size of the library. It should
        // be less than the space we reserved for it.
        size_t load_size = 0;
        size_t min_vaddr = 0;
        if (!GetLibraryLoadSize(addr, &load_size, &min_vaddr)) {
            LOG_ERROR("Unable to find size for load at %p", addr);
            return false;
        }

        // Trim the reservation mapping to match the library's actual size. Failure
        // to resize is not a fatal error. At worst we lose a portion of virtual
        // address space that we might otherwise have recovered. Note that trimming
        // the mapping here requires that we have already released the scoped
        // mapping.
        ResizeReservedAddressSpace(addr, size, load_size, min_vaddr);

        // Locate and if found then call the loaded library's JNI_OnLoad() function.
        using JNI_OnLoadFunctionPtr = int (*)(void* vm, void* reserved);
        auto jni_onload = reinterpret_cast<JNI_OnLoadFunctionPtr>(dlsym(handle, "JNI_OnLoad"));
        if (jni_onload != nullptr) {
            // Check that JNI_OnLoad returns a usable JNI version.
            int jni_version = (*jni_onload)(s_java_vm, nullptr);
            if (jni_version < JNI_VERSION_1_4) {
                LOG_ERROR("JNI version is invalid: %d", jni_version);
                return false;
            }
        }

        // Note the load address and load size in the supplied libinfo object.
        const size_t cast_addr = reinterpret_cast<size_t>(addr);
        s_lib_info_fields.SetLoadInfo(env, lib_info_obj, cast_addr, load_size);

        LOG_INFO("Success loading library %s", dlopen_library_path.c_str());
        return true;
    }

    // Create a shared RELRO file for a library, using android_dlopen_ext().
    //
    // Loads the library similarly to LoadLibrary() above, by reserving address
    // space and then using android_dlopen_ext() to load into the reserved
    // area. Adds flags to android_dlopen_ext() to saved the library's RELRO
    // memory into the given file path, then unload the library and returns.
    //
    // Does not call JNI_OnLoad() or otherwise execute any code from the library.
    //
    // |env| is the current JNI environment handle.
    // |clazz| is the static class handle for org.chromium.base.Linker,
    // and is ignored here.
    // |dlopen_ext_path| is the library identifier (e.g. libfoo.so).
    // |load_address| is an explicit load address.
    // |relro_path| is the path to the file into which RELRO data is written.
    // |lib_info_obj| is a LibInfo handle used to communicate information
    // with the Java side.
    // Return true on success.
    jboolean CreateSharedRelro(JNIEnv* env,
        jclass clazz,
        jstring dlopen_ext_path,
        jlong load_address,
        jstring relro_path,
        jobject lib_info_obj)
    {
        String dlopen_library_path(env, dlopen_ext_path);
        LOG_INFO("Called for %s, at address 0x%llx",
            dlopen_library_path.c_str(), load_address);

        if (!IsValidAddress(load_address) || load_address == 0) {
            LOG_ERROR("Invalid address 0x%llx", load_address);
            return false;
        }

        const size_t size = kAddressSpaceReservationSize;
        void* wanted_addr = reinterpret_cast<void*>(load_address);

        // Reserve the address space into which we load the library.
        ScopedAnonymousMmap mapping(wanted_addr, size);
        void* addr = mapping.GetAddr();
        if (addr == MAP_FAILED) {
            LOG_ERROR("Failed to reserve space for load");
            return false;
        }
        if (addr != wanted_addr) {
            LOG_ERROR("Failed to obtain fixed address for load");
            return false;
        }

        // Open the shared RELRO file for write. Overwrites any prior content.
        String shared_relro_path(env, relro_path);
        const char* filepath = shared_relro_path.c_str();
        unlink(filepath);
        int relro_fd = open(filepath, O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
        if (relro_fd == -1) {
            LOG_ERROR("open: %s: %s", filepath, strerror(errno));
            return false;
        }

        // Use android_dlopen_ext() to create the shared RELRO.
        const int flags = ANDROID_DLEXT_RESERVED_ADDRESS
            | ANDROID_DLEXT_WRITE_RELRO;
        AndroidDlextinfo dlextinfo(flags, addr, size, relro_fd);

        const char* path = dlopen_library_path.c_str();
        void* handle = nullptr;
        if (!AndroidDlopenExt(path, RTLD_NOW, &dlextinfo, &handle)) {
            LOG_ERROR("No android_dlopen_ext function found");
            close(relro_fd);
            return false;
        }
        if (handle == nullptr) {
            LOG_ERROR("android_dlopen_ext: %s", dlerror());
            close(relro_fd);
            return false;
        }

        // For https://crbug.com/568880.
        //
        // Release the scoped mapping. See comment in LoadLibrary() above for more.
        mapping.Release();

        // For https://crbug.com/568880.
        //
        // Unload the library from this address. Calling dlclose() will unmap the
        // part of the reservation occupied by the libary, but will leave the
        // remainder of the reservation mapped, and we have no effective way of
        // unmapping the leftover portions because we don't know where dlclose's
        // unmap ended.
        //
        // For now we live with this. It is a loss of some virtual address space
        // (but not actual memory), and because it occurs only once and only in
        // the browser process, and never in renderer processes, it is not a
        // significant issue.
        //
        // TODO(simonb): Between mapping.Release() and here, consider calling the
        // functions that trim the reservation down to the size of the loaded
        // library. This may help recover some or all of the virtual address space
        // that is otherwise lost.
        dlclose(handle);

        // Reopen the shared RELRO fd in read-only mode. This ensures that nothing
        // can write to it through the RELRO fd that we return in libinfo.
        close(relro_fd);
        relro_fd = open(filepath, O_RDONLY);
        if (relro_fd == -1) {
            LOG_ERROR("open: %s: %s", filepath, strerror(errno));
            return false;
        }

        // Delete the directory entry for the RELRO file. The fd we hold ensures
        // that its data remains intact.
        if (unlink(filepath) == -1) {
            LOG_ERROR("unlink: %s: %s", filepath, strerror(errno));
            return false;
        }

        // Note the shared RELRO fd in the supplied libinfo object. In this
        // implementation the RELRO start is set to the library's load address,
        // and the RELRO size is unused.
        const size_t cast_addr = reinterpret_cast<size_t>(addr);
        s_lib_info_fields.SetRelroInfo(env, lib_info_obj, cast_addr, 0, relro_fd);

        LOG_INFO("Success creating shared RELRO %s", shared_relro_path.c_str());
        return true;
    }

    const JNINativeMethod kNativeMethods[] = {
        { "nativeGetCpuAbi",
            "("
            ")"
            "Ljava/lang/String;",
            reinterpret_cast<void*>(&GetCpuAbi) },
        { "nativeLoadLibrary",
            "("
            "Ljava/lang/String;"
            "J"
            "Lorg/chromium/base/library_loader/Linker$LibInfo;"
            ")"
            "Z",
            reinterpret_cast<void*>(&LoadLibrary) },
        { "nativeCreateSharedRelro",
            "("
            "Ljava/lang/String;"
            "J"
            "Ljava/lang/String;"
            "Lorg/chromium/base/library_loader/Linker$LibInfo;"
            ")"
            "Z",
            reinterpret_cast<void*>(&CreateSharedRelro) },
    };

    const size_t kNumNativeMethods = sizeof(kNativeMethods) / sizeof(kNativeMethods[0]);

} // namespace

bool ModernLinkerJNIInit(JavaVM* vm, JNIEnv* env)
{
    LOG_INFO("Entering");

    // Register native methods.
    jclass linker_class;
    if (!InitClassReference(env,
            "org/chromium/base/library_loader/ModernLinker",
            &linker_class))
        return false;

    LOG_INFO("Registering native methods");
    if (env->RegisterNatives(linker_class, kNativeMethods, kNumNativeMethods) < 0)
        return false;

    // Record the Java VM handle.
    s_java_vm = vm;

    return true;
}

} // namespace chromium_android_linker
